package tidbcloud

import (
	"context"
	"time"

	"github.com/tidbcloud/account/idl/pbgen/proto/account"

	"github.com/Kong/go-pdk"

	"github.com/pingcap-inc/clinic/pkg/account_sdk"
	session2 "github.com/pingcap-inc/clinic/pkg/api_gateway/auth/session"
	"github.com/pingcap-inc/clinic/pkg/api_gateway/auth/utils"
)

func MWTryAuth(kong *pdk.PDK, externalAuth *account_sdk.Client) (*account.User, *utils.AuthErr) {
	keyString, exist := utils.GetBearToken(kong)
	if !exist || keyString == "" {
		// TODO:
		return nil, utils.NewAuthErr(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath)
	}

	if externalAuth == nil {
		// kong.Response.Exit(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath, map[string][]string{})
		_ = kong.Log.Err("externalAuth is nil")
		return nil, utils.NewAuthErr(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath)
	}

	ctx, f := context.WithTimeout(context.Background(), 8*time.Second)
	defer f()
	u, err := externalAuth.CheckToken(ctx, keyString)
	if u == nil || err != nil {
		if err != nil {
			_ = kong.Log.Err("check token failed, ", err.Error())
		} else if u == nil {
			_ = kong.Log.Err("check token return empty user")
		}
		// kong.Response.Exit(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath, map[string][]string{})
		return nil, utils.NewAuthErrWithErr(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath, err)
	}

	//err = kong.ServiceRequest.SetHeader("X-User-Id", fmt.Sprintf("%d", u.Id))
	//if err != nil {
	//	_ = kong.Log.Err("set header failed, ", err.Error())
	//	// kong.Response.Exit(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath, map[string][]string{})
	//	return nil, utils.NewAuthErrWithErr(session2.AUTH_ERROR_CODE, session2.InvalidAPIPath, err)
	//}

	return u, nil

	//return &session.CtxUser{
	//	Username:        u.Email,
	//	UserID:          uint(u.Id),
	//	Email:           u.Email,
	//	Internal:        strings.HasSuffix(u.Email, "@pingcap.com"),
	//	OrgIDInApiToken: 0,
	//}, nil
}